Ask HN: Why do you think vulnerable code is still being released today?

Well, that's approximately my experience too. "Meh, just ship it."

It's like asking "Why doesn't everyone know calculus in this day and age? It was discovered hundreds of years ago." Sometimes people are ignorant, lazy, under a time crunch, etc. When information became widely available(That SQL injection is bad and easy to fix) has little to do with how 5 random dudes working on a team write their code.

If you want reasons other than negligence.

The biggest reason is likely universities: I was there not too long ago (6-7 years), I wrote code that was secure against SQL injection - which lost me marks. They teach you to write insecure code and so help you God if you don't stick to what they have taught you.

Secondly is human error - that's to do with buffer overflows etc. You might say that we have static analysis, but...

Thirdly is that our static analysis tools simply are not "there" yet. They will catch the vast majority of vulnerabilities (especially when coupled together with contracts) but there are those corner cases that only a very creative security analyst will find.

Honestly though, if I was ever in a fire/hire position bringing SQL-injectable-code to a code review would be grounds for being fired on the spot.

My code is a delight. I wrote all the code myself. There is no malware. I did not write malware. Where will malware come from? You take my code and write programs. Where will malware come from.

A C64 had a ROM. We did not have malware.

As a consultant, I've seen a fair share of people building their own "ultra-secure" authentication, authorization, and encryption algorithms. One project simply took plain-text passwords, Base64-encoded them, reversed the result, and called the passwords "encrypted". Plenty of others would execute raw SQL without validating user input. This is an education problem.

Last winter we saw Ruby on Rails vulnerabilities that likely came about because the focus of the Rails framework has not traditionally been security. Rails is "optimized for programmer happiness". I'm cool with that, just know what you're getting in to when you choose to adopt a new framework (stay up to date with security patches and otherwise secure and monitor your web servers as best as you can). Any new framework that becomes widely adopted will likely go through the same type of problems.

With all of that said, I learned nothing about code security until I had to. University did not really touch on it, so most of my education on security came later in a workplace setting when I desperately needed it.